I don't think we should be defining the `User` model here. What the `auth` module should do is expect the presence of a `User` model with a given interface.

For example, we should allow the `User` model to return an identifying attribute whether its field is called `Username` or `Email` or `Anything`.

Thoughts?